Hi Qi,
FWIW, as he said in his response
(https://lists.busybox.net/pipermail/busybox/2025-April/091436.html),
Denys already commited something similar
(https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3).
Cheers,
Xabier Oneca_,,_
_
*Date: *Monday 31 March 2025 at 10:28
*To: *"busybox@busybox.net"
*Subject: *Re: [EXTERNAL] [RESEND(4) PATCH] archival: disallow path
traversals (CVE-2023-39810)
Will this patch be accepted? Or is it not suitable for busybox for
some reason? Regards, Qi On 10/11/24 15: 54, Ian No
On Wed, Oct 2, 2024 at 10:12 AM Peter Kaestle wrote:
>
> Create new configure option for archival/libarchive based extractions to
> disallow path traversals.
> As this is a paranoid option and might introduce backward
> incompatibiltiy, default it to no.
>
> Fixes: CVE-2023-39810
>
> Signed-off-by
busybox.net" , Denys Vlasenko
*Cc: *"martin.schob...@pentagrid.ch" ,
Peter Kaestle , Samuel Sapalski
*Subject: *[EXTERNAL] [RESEND(4) PATCH] archival: disallow path
traversals (CVE-2023-39810)
Create new configure option for archival/libarchive based extractions
to disallow pat
rtin.schob...@pentagrid.ch>, Peter
Kaestle <mailto:peter.kaes...@nokia.com>, Samuel
Sapalski <mailto:samuel.sapal...@nokia.com>
Subject: [EXTERNAL] [RESEND(4) PATCH] archival: disallow path traversals
(CVE-2023-39810)
Create new configure option for archival/libarchive based
busybox.net" , Denys Vlasenko
*Cc: *"martin.schob...@pentagrid.ch" ,
Peter Kaestle , Samuel Sapalski
*Subject: *[EXTERNAL] [RESEND(4) PATCH] archival: disallow path
traversals (CVE-2023-39810)
Create new configure option for archival/libarchive based extractions
to disallow pat
senko
Cc: "martin.schob...@pentagrid.ch" , Peter
Kaestle , Samuel Sapalski
Subject: [EXTERNAL] [RESEND(4) PATCH] archival: disallow path traversals
(CVE-2023-39810)
Create new configure option for archival/libarchive based extractions to
disallow path traversals. As this is a paranoid option
Create new configure option for archival/libarchive based extractions to
disallow path traversals.
As this is a paranoid option and might introduce backward
incompatibiltiy, default it to no.
Fixes: CVE-2023-39810
Signed-off-by: Peter Kaestle
Reviewed-by: Samuel Sapalski
---
archival/Config.sr
